USHIFT-6983: Drop optional components from tuned CI images#6782
Conversation
The tuned containerfiles inherited from the optional base image, which installed OLM, Istio, cert-manager, SR-IOV, and other optional components. None of the 3 scenarios using this image test optionals, but those components generated 58% of the slow etcd requests during startup on CPU-constrained ARM64 VMs (TuneD isolates most CPUs, leaving only 2 for system services). This etcd pressure contributes to PodSecurity admission timeouts that crash MicroShift on restart. Make the tuned containerfiles self-contained: inherit from test-agent, install only core MicroShift + microshift-low-latency, and configure firewall directly. This eliminates the optional component overhead without affecting any other image consumers.
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
openshift-ci-robot
added
the
jira/valid-reference
|
Skipping CI for Draft Pull Request. |
|
@pacevedom: This pull request references USHIFT-6983 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "5.0.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
WalkthroughTwo RHEL bootc test container images (EL10 rhel102 and EL9 rhel98) switch to test-agent bases, add templated RPM-repo copying and MicroShift RPM installs, enable MicroShift services, apply offline firewall rules, and CI now forces group2 tuned image rebuilds. ChangesMicroShift Test Container Updates
Sequence Diagram(s)sequenceDiagram
participant ComponentA
participant ComponentB
ComponentA->>ComponentB: observable interaction
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related PRs
Suggested reviewers
🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
/test ? |
openshift-ci
Bot
added
the
approved
|
/test e2e-aws-tests-bootc-release-arm-el9 |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In
`@test/image-blueprints-bootc/el10/layer4-release/group2/rhel102-bootc-brew-lrel-tuned.containerfile`:
- Around line 12-14: The COPY instruction currently copies
microshift-fast-datapath-rhel9.repo into the RHEL10 image (see the COPY line
referencing ./bootc-images/microshift-fast-datapath-rhel9.repo and the variable
USHIFT_RPM_REPO_NAME); update the containerfile so it copies the appropriate
RHEL10 fast-datapath repo (e.g., microshift-fast-datapath-rhel10.repo) or, if
using the RHEL9 repo is intentional, add a brief comment above the COPY
explaining why the RHEL9 repo is valid for this RHEL10 image and ensure the repo
file name/contents and USHIFT_RPM_REPO_NAME usage reflect that decision.
- Around line 19-23: EL10's RUN instruction installs "openssl" alongside
"firewalld" and "systemd-resolved" to force an OpenSSL upgrade for the
systemd-resolved/systemd bump; align the EL9 containerfile to match by adding
"openssl" to its dnf install line (and the same explanatory comment) or, if EL9
is intentionally different, add a clear comment in the EL9 containerfile
explaining why the OpenSSL workaround is not needed; update the RUN/dnf install
invocation that currently contains "firewalld systemd-resolved" to include
"openssl" (and mirror the repoinfo/install pattern) or add the justification
comment so the discrepancy is documented.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: c11db495-55f5-441d-84ed-0ec1c1e89821
📒 Files selected for processing (2)
test/image-blueprints-bootc/el10/layer4-release/group2/rhel102-bootc-brew-lrel-tuned.containerfiletest/image-blueprints-bootc/el9/layer4-release/group2/rhel98-bootc-brew-lrel-tuned.containerfile
|
/test e2e-aws-tests-bootc-release-arm-el9 |
4 similar comments
|
/test e2e-aws-tests-bootc-release-arm-el9 |
|
/test e2e-aws-tests-bootc-release-arm-el9 |
|
/test e2e-aws-tests-bootc-release-arm-el9 |
|
/test e2e-aws-tests-bootc-release-arm-el9 |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@test/bin/ci_phase_iso_build.sh`:
- Around line 128-130: This TEMP forced-rebuild block using $(dry_run) bash -x
./bin/build_bootc_images.sh -f -g
./image-blueprints-bootc/el9/layer4-release/group2 and the el10 equivalent must
be removed before merge; while it exists, change it to (1) gate the invocation
by the job OS so an arm-el9 job does not also trigger the el10 build (use
whatever job OS/env variable is available in the script to conditionally run the
el9 vs el10 call), and (2) avoid rebuilding the whole group by invoking
build_bootc_images.sh in a mode that only rebuilds changed containerfiles (or
pass a list of changed blueprints) instead of -g .../group2; keep the $(dry_run)
behavior intact while testing.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Central YAML (inherited)
Review profile: CHILL
Plan: Enterprise
Run ID: adc343f4-f933-45e8-af05-6a16ad2a85e3
📒 Files selected for processing (1)
test/bin/ci_phase_iso_build.sh
|
/test e2e-aws-tests-bootc-release-arm-el9 |
openshift-ci
Bot
removed
the
do-not-merge/work-in-progress
|
/lgtm |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: ggiguash, pacevedom The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/verified by CI |
openshift-ci-robot
added
the
verified
|
@pacevedom: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
/override ci/prow/e2e-aws-tests-bootc-release-arm-el9 |
|
/cherry-pick release-4.22 |
|
@pacevedom: once the present PR merges, I will cherry-pick it on top of DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
@pacevedom: Overrode contexts on behalf of pacevedom: ci/prow/e2e-aws-tests-bootc-release-arm-el10, ci/prow/e2e-aws-tests-bootc-release-arm-el9 DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
|
@pacevedom: new pull request created: #6791 DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
4 participants
The tuned containerfiles inherited from the optional base image, which installed OLM, Istio, cert-manager, SR-IOV, and other optional components. None of the 3 scenarios using this image test optionals, but those components generated 58% of the slow etcd requests during startup on CPU-constrained ARM64 VMs (TuneD isolates most CPUs, leaving only 2 for system services). This etcd pressure contributes to PodSecurity admission timeouts that crash MicroShift on restart.
Make the tuned containerfiles self-contained: inherit from test-agent, install only core MicroShift + microshift-low-latency, and configure firewall directly. This eliminates the optional component overhead without affecting any other image consumers.
Summary by CodeRabbit